[Entity Analytics][Privmon] Use default UUIDs for monitoring source saved objects

[hop-dev]

Summary

revert to using the default UUID generation for monitoring data source saved objects and remove any reference to temp-id. Previously we were generating the ID using the integration name or index name and the namespace, and also overriding this with temp-id.

• remove temp-id refs
• add ID param to the get and update routes URL
• Remove the behaviour where the create API will update if the source already exists

Testing

Steps Taken from #221610

• Pull branch into local machine
• Security experimental flag enable: 'privilegeMonitoringEnabled'
• Start up ElasticSearch and Kibana

1. Optional - create the default index, this should just skip if you don't make it.

POST entity_analytics.privileged_monitoring/_doc
{
  "user": {
    "name": "default name"
  }
}

2. Create test index/ indicies

PUT /tatooine-
{
  "mappings": {
    "properties": {
      "user": {
        "properties": {
          "name": {
            "type": "keyword",
            "fields": {
              "text": {
                "type": "text"
              }
            }
          }
        }
      }
    }
  }
}

POST tatooine-/_bulk
{ "index": {} }
{ "user": { "name": "Luke Skywalker" } }
{ "index": {} }
{ "user": { "name": "Leia Organa" } }
{ "index": {} }
{ "user": { "name": "Han Solo" } }
{ "index": {} }
{ "user": { "name": "Chewbacca" } }
{ "index": {} }
{ "user": { "name": "Obi-Wan Kenobi" } }
{ "index": {} }
{ "user": { "name": "Yoda" } }
{ "index": {} }
{ "user": { "name": "R2-D2" } }
{ "index": {} }
{ "user": { "name": "C-3PO" } }
{ "index": {} }
{ "user": { "name": "Darth Vader" } }

3. Register Monitoring Entity Source Saved Objects

POST kbn:/api/entity_analytics/monitoring/entity_source
{
  "type": "index",
  "name": "StarWars",
  "managed": true,
  "indexPattern": "tatooine-",
  "enabled": true,
 "matchers": [
    {
      "fields": ["user.role"],
      "values": ["admin"]
    }
  ],
  "filter": {}
}

- OPTIONAL: You can check what is in the monitoring entity_source SO:

GET kbn:/api/entity_analytics/monitoring/entity_source/list

4. Initialise monitoring engine:

POST kbn:/api/entity_analytics/monitoring/engine/init {}

5. Verify Users in Monitoring Index

• Check the list of synced user, should include:
• • The created users
• • The default user (if you created it)

GET kbn:/api/entity_analytics/monitoring/users/list

e.g. output:

[
 {
   "id": "FkMJoZcB7muj1aiwb_eQ",
   "user": {
     "name": "C-3PO",
     "is_privileged": true
   },
   "labels": {
     "sources": [
       "index"
     ],
     "source_indices": [
       "tatooine-"
     ],
   }
 },
 {
   "id": "F0MJoZcB7muj1aiwb_eQ",
   "user": {
     "name": "Chewbacca", 
      "is_privileged": true
   },
   "labels": {
     "sources": [
       "index"
     ],
     "source_indices": [
       "tatooine-"
     ],     
   }
 },
// ... more here 

Testing: Removing Stale Users

The engine should soft delete users from the internal index if they no longer appear in the synced sources - e.g. label as monitoring.privileged_users: "not_monitored"
Example:

• Delete users in index:

POST tatooine-/_delete_by_query
{
 "query": {
   "terms": {
     "user.name": ["Chewbacca", "Han Solo"]
   }
 }
}

• re-run engine init

POST kbn:/api/entity_analytics/monitoring/engine/init
{}

-Fetch the updated user list:

GET kbn:/api/entity_analytics/monitoring/users/list

You should now only see both Chewbacca and Han Solo are no longer privileged:

// ..
{
   "id": "GUMJoZcB7muj1aiwb_eQ",
   "user": {
     "name": "Han Solo"
     "is_privileged": false 
   },
   "labels": {
     "sources": [],
     "source_indices": [],
   }
 }
]

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[machadoum]

😍

[machadoum]

Code LGTM!

I did not desk-test it.

[machadoum]

What is it for? It doesn't do anything to my editor 🤔

[hop-dev]

@elasticmachine merge upstream

[kibanamachine]

Starting backport for target branches: 9.1

https://github.com/elastic/kibana/actions/runs/16225554007

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: ac93600

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	9.8MB	9.8MB	-2.0B

History

• 💚 Build #317706 succeeded 961ead0
• 💔 Build #317679 failed b639a6c

cc @hop-dev

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation